Skip to contentSkip to conversation

polarssl: don't use deprecated functions anymore

PATCH In review Steffan Karger 2 participants 2 messages Nov 21, 2015 – Nov 22, 2015

lore
Share & tools
lore

Steffan Karger

author
#0 lore raw

PATCH 1/1 polarssl: don't use deprecated functions anymore

A number of functions were deprecated in polarssl 1.3.11. Stop using these, and use their alternatives instead.

This enables (and also almost forces) us to move the pkcs11 and external key logic from the per-connection setup (key_state_ssl_init()) to the per-instance setup (tls_ctx_use_{pkcs11,external_private_key}()).

Note that tls_ctx_use_external_private_key() is now placed right below external_pkcs1_sign() and external_key_len(), instead of right above, because it now needs to be aware of those static functions.

Tested with:
* PEM key files
* pkcs11
* management-external-key

Signed-off-by Steffan Karger <[email protected]...>
---
 src/openvpn/crypto_polarssl.c     |  6 ++--
 src/openvpn/pkcs11_polarssl.c     |  6 ++++
 src/openvpn/ssl_polarssl.c        | 59 +++++++++++++++++----------------------
 src/openvpn/ssl_verify_polarssl.c |  5 ++--
 4 files changed, 36 insertions(+), 40 deletions(-)
src/openvpn/crypto_polarssl.c +3 -3
index af6e873..dec6d9a 100644
@@ -485,7 +485,7 @@ cipher_ctx_init (cipher_context_t *ctx, uint8_t *key, int key_len,
 
 void cipher_ctx_cleanup (cipher_context_t *ctx)
 {
-  ASSERT (polar_ok(cipher_free_ctx(ctx)));
+  cipher_free(ctx);
 }
 
 int cipher_ctx_iv_length (const cipher_context_t *ctx)

@@ -649,7 +649,7 @@ void
 md_ctx_final (md_context_t *ctx, uint8_t *dst)
 {
   ASSERT(0 == md_finish(ctx, dst));
-  ASSERT(0 == md_free_ctx(ctx));
+  md_free(ctx);
 }
 
 

@@ -680,7 +680,7 @@ hmac_ctx_init (md_context_t *ctx, const uint8_t *key, int key_len, const md_info
 void
 hmac_ctx_cleanup(md_context_t *ctx)
 {
-  ASSERT(0 == md_free_ctx(ctx));
+  md_free(ctx);
 }
 
 int
src/openvpn/pkcs11_polarssl.c +6 -0
index 4018b22..ccb6f8c 100644
@@ -62,6 +62,12 @@ pkcs11_init_tls_session(pkcs11h_certificate_t certificate,
       goto cleanup;
   }
 
+  ALLOC_OBJ_CLEAR (ssl_ctx->priv_key, pk_context);
+  if (!polar_ok(pk_init_ctx_rsa_alt(ssl_ctx->priv_key, ssl_ctx->priv_key_pkcs11,
+	ssl_pkcs11_decrypt, ssl_pkcs11_sign, ssl_pkcs11_key_len))) {
+      goto cleanup;
+  }
+
   ret = 0;
 
 cleanup:
src/openvpn/ssl_polarssl.c +25 -34

77 lines not on this page · raw message

src/openvpn/ssl_verify_polarssl.c +2 -3
index fa313ac..62818ad 100644
@@ -319,8 +319,7 @@ x509_verify_cert_eku (x509_crt *cert, const char * const expected_oid)
 	  char oid_num_str[1024];
 	  const char *oid_str;
 
-	  oid_str = x509_oid_get_description(oid);
-	  if (oid_str != NULL)
+	  if (0 == oid_get_extended_key_usage( oid, &oid_str ))
 	    {
 	      msg (D_HANDSHAKE, "++ Certificate has EKU (str) %s, expects %s",
 		  oid_str, expected_oid);

@@ -331,7 +330,7 @@ x509_verify_cert_eku (x509_crt *cert, const char * const expected_oid)
 		}
 	    }
 
-	  if (0 < x509_oid_get_numeric_string( oid_num_str,
+	  if (0 < oid_get_numeric_string( oid_num_str,
 	      sizeof (oid_num_str), oid))
 	    {
 	      msg (D_HANDSHAKE, "++ Certificate has EKU (oid) %s, expects %s",
Signature · 1 line
2.5.0
#1 lore raw

ACK, based on "it looks reasonable" and "passes all my tests" (and there is a certain matter of trust here that these functions really are what should be used :-) - googling turned up depreciation comments in various polar/embedssl headers for the "easy ones", like md_free_ctx() though)

Your patch has been applied to the master branch.

commit 67a67e39895d9c2c7af08e7fb38ba341e6be8fb6

Author: Steffan Karger
Date:   Sat Nov 21 12:41:00 2015 +0100
     polarssl: don't use deprecated functions anymore

     Signed-off-by: Steffan Karger <[email protected]...>
     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/10544
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering